External risk intelligence

OpenYak RCE via Local HTTP API Insecure Binding

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-46409

The vulnerability exists in a local-first desktop application that binds its API exclusively to the loopback interface (127.0.0.1). It is not reachable from the public internet, as it is intended for local execution on a user's machine and does not provide an externally facing network service.

Code Injection

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in the OpenYak desktop application that, if exploited, could allow a malicious website to execute commands on a user's computer without their interaction. The issue stems from the application's local server not adequately validating requests coming from a user's browser, creating a pathway for potential remote code execution and data exfiltration.

Malicious websites can run commands on your computer.
Confirms a serious flaw affecting user data and system control.
Verify if OpenYak is deployed and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker can leverage a user's web browser to interact with the OpenYak desktop backend. By tricking a user into visiting a specially crafted webpage, an attacker can send requests to OpenYak's local HTTP API. This API lacks proper validation, allowing the malicious webpage to execute arbitrary shell commands, shut down the service, or steal sensitive data, all without requiring any action from the user beyond viewing the page.

User visits a malicious webpage.
Webpage sends requests to local API.
Arbitrary commands executed, data exfiltrated.

Live Threat

Current exploitation, exposure, and threat context

When OpenYak is running, a malicious webpage could trigger vulnerabilities that allow it to execute arbitrary shell commands on the host machine by proxying requests through the browser to the local HTTP API. This could also lead to the shutdown of the service and the exfiltration of chat history and account PII without further user interaction, provided the build agent has specific permissions enabled.

Sensitive account and chat data.
Malicious webpage interaction.
Arbitrary command execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

The OpenYak desktop application, when running and a user visits a malicious webpage, can be exploited to execute arbitrary shell commands, shut down the service, or exfiltrate data. This occurs because the HTTP API binds to `127.0.0.1` without proper server-side validation, allowing cross-origin requests from the browser. The platform team or the team responsible for managing local developer tools should investigate this vulnerability.

Platform/developer tool owners should own this.
Verify OpenYak installations and reachability.
Plan remediation based on installed versions.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is OpenYak?

OpenYak is a local-first agent runtime designed to support AI models that use various tools. It includes a desktop workspace that users interact with to run these agents locally on their machines. The software manages the connection between these models and system resources.

How does CVE-2026-46409 affect OpenYak security?

This vulnerability involves a lack of proper validation on the application's local HTTP API. It falls under several weakness classes, including Improper Neutralization of Input During Web Page Generation and Missing Authentication. Essentially, the software fails to confirm that requests are legitimate, allowing unauthorized access to its internal functions.

When does this vulnerability trigger?

The issue triggers when a user has the OpenYak desktop application running and simultaneously visits a malicious webpage in their browser. Simply viewing such a page allows the browser to send unintended commands to the local OpenYak server. The vulnerability does not trigger if the application is completely closed or if the user avoids visiting untrusted websites while the service is active.

Is my machine reachable from the internet for this CVE?

According to Halo Surface Signal, this vulnerability is classified as unlikely to be reached from the public internet. Because OpenYak binds its API specifically to the local loopback interface (127.0.0.1), it is designed to communicate only with processes on the user's host machine. The primary threat comes from a local web browser acting as a proxy rather than a direct external network attack.

How do I secure my system against this issue?

The primary response is to update your OpenYak installation to version 1.1.3 or later. This version introduces the necessary validation and security controls to block unauthorized cross-origin requests. If you cannot update immediately, ensure that you only run the application when necessary and exercise caution regarding which websites you visit in your browser while the service is active.

References

github.com/openyak/openyak/security/advisories/GHSA-ccxp-q2w5-27jw

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.